Closed Bug 741206 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: Bad SSA value, at ../jsanalyze.h:1084

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase, Whiteboard: [jsbugmon:update,ignore]) 

The following testcase asserts on ionmonkey revision e96d5b1f47b8 (run with --ion -n -m):


function test_it(RUNS) {
  for (var c = 1; c <= RUNS; ++c) { }
  if (!(let ( [ r ]  = expectThrowTypeError(function() { r.exec("foopy"); })) (function(){ var node = new actual(); }).gen1)) { }
}
test_it(20);
Whiteboard: [jsbugmon:update]
JSBugMon: The testcase found in this bug no longer reproduces (tried revision 67bf9a4a1f77).
Whiteboard: [jsbugmon:update] → [jsbugmon:update,ignore]
Bisection failed here, but I haven't been hitting this bug anymore in the fuzzer. Closing as WFM.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.